git: 35d83ba23556 - stable/13 - Close races in vm object chain traversal for unlock

[Konstantin Belousov]

The branch stable/13 has been updated by kib:

URL: https://cgit.FreeBSD.org/src/commit/?id=35d83ba2355692a4d323936086bbf36aa95ce43b

commit 35d83ba2355692a4d323936086bbf36aa95ce43b
Author:     Ryan Libby <rlibby at FreeBSD.org>
AuthorDate: 2021-02-25 20:11:19 +0000
Commit:     Konstantin Belousov <kib at FreeBSD.org>
CommitDate: 2021-05-22 09:38:29 +0000

    Close races in vm object chain traversal for unlock
    
    (cherry picked from commit d7671ad8d6ebe205933628466dc0a52d32eea2e8)
---
 sys/fs/procfs/procfs_map.c | 5 +++--
 sys/kern/kern_proc.c       | 6 +++---
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/sys/fs/procfs/procfs_map.c b/sys/fs/procfs/procfs_map.c
index eaa1cf8d4d35..9ee49b0149a2 100644
--- a/sys/fs/procfs/procfs_map.c
+++ b/sys/fs/procfs/procfs_map.c
@@ -84,7 +84,7 @@ procfs_doprocmap(PFS_FILL_ARGS)
 	struct vnode *vp;
 	char *fullpath, *freepath, *type;
 	struct ucred *cred;
-	vm_object_t obj, tobj, lobj;
+	vm_object_t lobj, nobj, obj, tobj;
 	int error, privateresident, ref_count, resident, shadow_count, flags;
 	vm_offset_t e_start, e_end;
 	vm_eflags_t e_eflags;
@@ -144,7 +144,8 @@ procfs_doprocmap(PFS_FILL_ARGS)
 		}
 		if (obj != NULL)
 			kern_proc_vmmap_resident(map, entry, &resident, &super);
-		for (tobj = obj; tobj != NULL; tobj = tobj->backing_object) {
+		for (tobj = obj; tobj != NULL; tobj = nobj) {
+			nobj = tobj->backing_object;
 			if (tobj != obj && tobj != lobj)
 				VM_OBJECT_RUNLOCK(tobj);
 		}
diff --git a/sys/kern/kern_proc.c b/sys/kern/kern_proc.c
index d2414df60d7a..33f168836370 100644
--- a/sys/kern/kern_proc.c
+++ b/sys/kern/kern_proc.c
@@ -2505,7 +2505,7 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags)
 	vm_map_entry_t entry, tmp_entry;
 	struct vattr va;
 	vm_map_t map;
-	vm_object_t obj, tobj, lobj;
+	vm_object_t lobj, nobj, obj, tobj;
 	char *fullpath, *freepath;
 	struct kinfo_vmentry *kve;
 	struct ucred *cred;
@@ -2554,8 +2554,8 @@ kern_proc_vmmap_out(struct proc *p, struct sbuf *sb, ssize_t maxlen, int flags)
 			    &kve->kve_resident, &super);
 			if (super)
 				kve->kve_flags |= KVME_FLAG_SUPER;
-			for (tobj = obj; tobj != NULL;
-			    tobj = tobj->backing_object) {
+			for (tobj = obj; tobj != NULL; tobj = nobj) {
+				nobj = tobj->backing_object;
 				if (tobj != obj && tobj != lobj)
 					VM_OBJECT_RUNLOCK(tobj);
 			}